In 2018, one-third of the world's population was affected by cybersecurity data breaches. (1) If you are reading this article, you were probably one of the affected people.
In September 2018, Facebook announced an attack on its network exposed information of approximately 50 million users. (2) Of those 50 million, it was determined 30 million had their passwords stolen. (3) This marked the largest cybersecurity breach in Facebook's history.
Also in September 2018, an unauthorized user was able to access the network of Starwood Hotels and Resorts Worldwide LLC, a subsidiary of Marriott International Inc., and gained personal information of approximately 500 million guests who made reservations at a Starwood property. (4) In 2017, approximately 146 million consumers in the U.S. were affected by a security breach at Equifax in which names, social security numbers, credit card information, and other personally identifiable information (Pll) were compromised. (5) The fallout of this cybersecurity breach is expected to cost Equifax $439 million. (6)
In other instances, perpetrators not only gained access to, and control of, information systems, but they also leveraged the attack to set a ransom. In 2017, ransomware hit 45,000 computers across 99 countries. (7) Also, in July 2019, hackers infected QuickBooks' cloud provider, iNSYNQ, with ransomware keeping clients from accessing financial data that supports business operations. (8) Ransomware can encrypt all files on an organization's network to prevent access to information, resulting in the shutdown of all business operations. The goal of a ransomware attack is to extort data owners for digital currency, usually in the form of Bitcoin for the return of control to their information systems.
Phishing attacks are also becoming more and more prevalent because perpetrators can circumvent security configurations by targeting users via email and tricking them with spoofed links and websites that are created to gather user ID, password, and other sensitive data. According to a report published by the cybersecurity firm, Proofpoint, "83 percent of global info security respondents experienced phishing attacks in 2018 which is up from 76 percent in the previous year." (9)
Cyber-attacks are not limited to private organizations. They also pose a great threat to government agencies. In early 2016, an attack on the Federal Bureau of Investigation (FBI) and the Department of Homeland Security (DHS) revealed contact information of nearly 30,000 employees. (10) Additionally, in June 2015, 5.6 million fingerprints were stolen from the Office of Personnel Management (OPM). (11) These infiltrations on the government can be more devastating as they give a reason for the public to lose trust in the government, and remediation of these attacks weigh heavily on the taxpayer.
Even the Military faces challenges related to cyber-attacks. Let's look at some of the challenges at the Army National Guard (ARNG). The ARNG manages the personnel data of more than 300,000 ARNG soldiers across 54 States and US territories. Bad actors are constantly attempting to hack into the systems that house this information. To protect against this, ARNG implements special care in managing and protecting information systems at the national level. The maintenance of cybersecurity principles has been a challenge for ARNG systems designed to deliver personnel data quickly and accurately. However, basic cybersecurity principles are key to keeping the valuable information of National Guard soldiers safe and free from exploitations. National Institute of Standards and Technology (NIST) publications and the Department of Defense (DoD) Risk Management Framework (RMF) provide comprehensive guidance on how to implement a continuously monitored, risk-based security program, but can be confusing or even incomprehensible without a background in information security. To mitigate this, basic principles are shared with system owners and users to maintain the confidentiality, integrity, and accessibility of information systems.
Why are cyber-attacks increasing? For the money! Physically breaking into a home or business to steal money has figuratively become a thing of the past. Attackers can hide behind their computers, avoid physical risk, and potentially gain access to what is most valued: your identity and every digital account associated with it. This stolen information is used for personal gain by extorting individuals and organizations or selling that information to others with malicious intent.
Today, cybersecurity risk has increased due, in large part, to the boundaries between internal systems and external networks rapidly diminishing in order to support interconnectivity. With the vast array of information stored online, we have created a virtual piggybank populated with social security numbers, addresses, financial information, and even our personal traits and interests. This environment has opened the door for hackers to prey on unsuspecting users. Organizations must understand threats to information flows, such as those that initiate, authorize, record, process, and report financial matters which have a material effect on financial statements. Then, organizations can begin implementing required measures to reduce vulnerabilities and strengthen their network of information systems.
Considering these ubiquitous dangers, cybersecurity has become a major topic that has gained national attention.
As a result of this newfound spotlight, we now know personal information is a precious commodity to both organizations and criminals alike.
Organizations must take steps to protect sensitive information and prevent unauthorized access in order to preserve the integrity of data and ensure the availability of systems. By adhering to the following principles, you can finally take those steps to improve the cybersecurity of your information systems.
The first step in securing your...